LDAP, Loads of People, and Account Management Middleware @UMBC LDAP, Loads of People, and Account Management

Middleware @UMBC Motivations Introduction to LDAP Managing People Our First Application: Account Management

What is a Directory Service? Data Hardware and Software Policies and Procedures

Why build a Directory Service? Consolidation of existing directories Reduce replication of: Policies Data Means: LESS WORK!

Internet 2 Middleware Project http://www.internet2.edu/middleware UMBC is one of 11 participating institutions Goal: Enable inter- & intra-institutional collaboration How: Agreed upon data representation and policies

UMBC’s Environment Tightly centralized environment One department (OIT) manages most data sources Human Resources SIS “Technical” Data Access problems are simple to solve

Pre LDAP Environment PH/CSO Nameserver Authorization (Unix): NIS Account Database @umbc.edu Mail Redirection Authorization (Unix): NIS Authentication (Unix, NT): Kerberos Account Management: AGUS

PH/CSO Nameserver Designed by UIUC, early to mid ’90’s. Indexed for speedy lookups Flat organization “Static” Schema “Synchronized” with HR & SIS systems via text file dumps + perl scripts

Kerberos Developed at MIT Cross-platform network authentication, including mutual client-server authentication http://www.mit.edu/afs/athena.mit.edu/astaff/project/kerberos/www

AGUS Account Generationg <something something> Developed at UMBC in 1992, overhauled in 1994-95 http://www.umbc.edu/people/paulr/lisa95.pdf

Brief Introduction to LDAP Definition Features Example Entries

LDAP - Definition Lightweight Directory Access Protocol Originally designed as a front-end to X.500 Not reliant on the bulky OSI protocol stack

LDAP - Features Structure Flexible Schema Security (authentication) Security (access) Replication / Distribution of Services

LDAP - Structure Formed by the interpretation of the “Distinguished Names” of elements Uid=banz,ou=accounts,o=umbc.edu O=umbc.edu Ou=accounts Ou=people Uid=banz

LDAP - Structure Distinguished Names are unique Attribute Types that make it up are not restricted Typical Attributes: Ou: Organizational Unit O: Organization

LDAP – Schema (objects) Entry is a member of one or more object classes An Object Class defines which attributes are required or optional

LDAP – Schema (attributes) An attribute has an identifier (name), and associated meaning. The meaning of the attribute is typically described in the objectClass definition that first used the attribute. While attributes can be used in other objectClasses, it’s “meaning” should remain the same.

LDAP – Schema (attributes cont) An attribute is typically one of CIS ( Case Ignore String) CES ( Case Sensitive String ) BIN ( Binary ) DN (A Distinguished Name) INT (An Integer) …Other attribute syntaxes exist, these are just the most typical Attributes can be Single Valued or Multi-Valued

Example Object - Person The following is a very simple objectclass, “person” Objectclass person oid 2.5.6.6 superior top requires sn, (sirname) cn (common name) allows description, seeAlso telephoneNumber, userPassword

Example Object - organizationalPerson The following is a very simple objectclass, “person” Objectclass person oid 2.5.6.7 superior person allows detinationIndicator, fascimilieTelephoneNumber, internationalSDNNumber, l, ou, physicalDeliveryOfficeName, postOfficeBox, postalAddress, postalCode, preferredDeliveryMethod, registeredAddress, st, street, … Note, that since org…Person includes person...

LDAP – Security (authentication) “Bind” (connect) to the service Anonymously, or A DN Usually with a simple password, however other methods are supported Kerberos SSL … extensible

LDAP - Replication Multiple Servers == Redundancy Can replication parts, or all, of the directory Implementation Specific

A “Person” Here’s a “typical” Person entry, of class umbcPerson (superior inetOrgPerson) Affiliation: staff Billingaddress: 8107 Callo Ln\nBaltimore, MD 21237 CampusPostalAddress: 8107 Callo Ln\nBaltimore, MD 21237 Cn: Robert Banz Cn: Banz, robert A. Createtimestamp: 20000810004455Z Creatorsname: uid=admin,ou=Administrators,ou=TopologyManagment,o=NetscapeRoot Dateofbirth: 08-Aug-72 Departmentnumber: 360080 Givenname: robert Guid= 6cbfa31e-6e14-11d4-9669-8020cd7816 Homephone: 4106543175 Mailacceptinggeneralid: robert_banz Mailacceptinggeneralid: robert.banz Maildrop: banz@umbc.edu Modifiersname: uid=admin,ou=Administrators,ou=TopologyManagment,o=NetscapeRoot Modifytimestamp: 20000901162434Z

…more person Objectclass: top Objectclass: person Objectclass: organizationalPerson objectClass: inetOrgPerson objectClass: umbcPerson postalAddress: 1 Wellhaven Cir\nApt 1225\nOwings Mills, MD 21117 Roomnumber: ECS Sn: banz Socialsecuritynumber: xxx885013 telephoneNumber: 4104553933 Umbcbuckley: 00 Umbcdatasource: SIS Umbcdatasource: HR Umbcdatecurrenttitle: 20000326050000Z Umbcdepartment: Office of Informaiton Technology Umbchiredate: 19980126050000Z Umbclasttermelig: 199509 Umbclasttermreg: 199509 Umbcnameconfidential: 00 Umbcofficebuilding: Engineering/Computer Science Umbcterminationcode: N Umbctitle: Technical Coordinator

UMBC’s Person Database Represent all needed HR & SIS information in an LDAP Database (near) Real-Time synchronization Entries are Eternal Unique Non-Reusable

Our Identifier Must be “Universally Unique” Using the DCE UUID Guaranteed unique over all time and space Not particularly for human consumption

Structure - Hierarchical Location in the tree conveys meaning Ideal for corporate environments Difficult for Universities

Structure - Flat No meaning is conveyed by position, but by Group Membership, or Information in entry Person’s position remains static, while position in the organization can be fluid

UMBC’s Schema Keep in mind Internet2 Middleware Standards, it’s all about “interoperation” Unfortunately, standards are not complete Eduperson http://www.educause.edu/eduperson

Implementation Made up of three main elements LDAP Server Software Hardware Glue

Implementation - Software Chose Netscape Directory Server Mature product Considered the best, but not cheap Handles the Load Our Person Database has ~300,000 entries Other Alternatives OpenLDAP Innosoft NDS … many more

Hardware Master Server Slave Servers (2) Sun Enterprise 220R, 2G RAM (yes, it uses it) 2x 440mhz processors Slave Servers (2) Sun NetraT1 512M RAM (would love to have more) 1x 440mhz processor

Glue Changes to Oracle SIS & HR tables cause entries to be made in a changelog table Perl script Scans the log table, and makes the appropriate changes Web Based utilities for editing & adding entries

Future Directions Campus MetaDirectory Driving Other Applications Synchronize the data sources we are synchronizing with Driving Other Applications Card Key Access Control Single Application Interface

UMBC’s Account Management First application to make use of the LDAP Person Directory It, itself, keeps most of it’s data in LDAP

Account Management - Goals Utilize the Person Database for account authorization information Web-Enabled, for Self Service Account Creation Password Changing Near-Real-Time Creation Manage both Krb5 & AFS metadata Populate User’s account w/ default files Manage the @umbc.edu Email Address Space Utilize RFC2307 Compliant Schema

Account Management - Bitses WebAdmin Interfaces Kerberos & AFS Manager (accountqd) LDAP Based Mail Redirector NIS Map Generator

WebAdmin Interfaces Allows both self-service & Administrator level Account Creation Account Activation Account Editing Kerberos 5 Password Changes … other administrative tasks

accountqd Perl Daemon Periodically (every 5 minutes), checks for account entries that need processing Creates Kerberos 5 Instance AFS ‘pts’ database entry AFS Volume Populates AFS volume with default files

LDAP Based Mail Redirector Part of Sendmail 8.11 Also in previous versions, but less mature Listed as other Alias maps One map keys on “mailacceptinggeneralid” in ou=People,o=umbc.edu – returns the maildrop entry(s) that are associated with the matching dn. Other keys on “uid” in ou=Accounts,o=umbc.edu – returns the maildrop entries(s). Much quicker than the old “phquery” mailer 

NIS Map Updater Perl Script Runs every 15 minutes on NIS master servers Generates NIS maps based on information in the ou=Accounts tree Will be replaced…

Future Stuff WebAdmin interface isn’t complete Alias Management Account Deletion (yay!) … however, first few weeks of a semester are kind of busy  OS’s that support it (Solaris, IRIX, etc) can query LDAP directly (the RFC2307 Schema thing)

Places to Visit Internet2 – http://www.internet2.edu WebAdmin – http://webadmin.umbc.edu/ LDAPworld – http://www/innosoft.com/ldapword ModPerl (all of our interfaces are written in it) – http://perl.apache.org UMBC’s UCE Home – http://www.gl.umbc.edu If we post any of our code, this is where you’ll find it.